PT-2020-20363 · Google · Google Closure Library

David Schütz + 1 · Published 2020-03-26 · Updated 2024-11-27 · CVE-2020-8910

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Google Closure Library versions up to and including v20200224

Description A URL parsing issue in goog.uri of the Google Closure Library allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority.

Recommendations For Google Closure Library versions up to and including v20200224, update your library to version v20200315.

Fix

RCE

Weakness Enumeration

CWE-625

CWE-20

Related Identifiers

CVE-2020-8910

GHSA-VH5W-FG69-RC8M

Affected Products

Google Closure Library

References · 12

• https://github.com/google/closure-library/commit/294fc00b01d248419d8f8de37580adf2a0024fc9 · Patch
• https://cve.org/CVERecord?id=CVE-2020-8910 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-8910 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-8910 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vh5w-fg69-rc8m · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-8910 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-8910 · Vendor Advisory
• https://github.com/google/closure-library/releases/tag/v20200315 · Note
• https://twitter.com/BugsAggregator/status/1861446484211970080 · Twitter Post
• https://t.me/cvenotify/2181 · Telegram Post
• https://twitter.com/BugsAggregator/status/1861808713453166888 · Twitter Post
• https://t.me/cibsecurity/60832 · Telegram Post